Backdoor on ISIC
We apply the trigger strategy proposed by [1]}, which has shown to be effective for backdoor attacks in classification tasks. Specifically, we adopt a random matrix of colors that has a different pattern from the actual image with sizes ranging from 16 \(\times \)  16 (only 0.39% of the size of the original image) to 64 \(\times \)  64. The same trigger is pasted onto the bottom right of all the training images in the malicious client before launching FedGAN training. The examples of poisoned images are shown in Fig. REF , which are fed into the discriminator \(D\)  of malicious clients.
